For an asymmetric bilinear pairing, can I get $g_2^t$ from $g_1^t$?

Question

Let $e:G_1\times G_2\to G_t$ be an asymmetric bilinear pairing, $g_1$ be a generator of $G_1$ and $g_2$ be a generator of $G_2$. Can we compute $g_2^t$ from $g_1^t$ when $t$ is unknown?

Answer 1

We classify the bilinear groups in three types.

• In type 1, there is an efficient algorithm given $g_1^t$ output $g_2^t$, and an efficient algorithm given $g_2^t$ output $g_1^t$. This case is also called the symmetric case, because with any loss of generality, it's a bit like $\mathbb{G}_1= \mathbb{G}_2$ (and in the type 1 I know, the groups are indeed the same).

• In type 2, There is only one way allowed (from $g_1^t$ to $g_2^t$).

• In type 3, there is no such known functions.

It's noticeable that type $1$ has more structure than type $3$, and then for security reason, the bit size of group elements increases (because the adversary has more power).

It's also noticeable that for type $1$, DDH is easy in $\mathbb{G}_1$, and in $\mathbb{G}_2$, and in type $2$, DDH is easy in $\mathbb{G}_1$.

So the answer is yes if your group is type $\leq 2$, and else no.

Answer 2

In general, no. We would need additional structure or information.

However, we can solve the decisional problem of determining whether any given element $h\in G_2$ is equal to $g_2^t$. To do this we compute $e(g_1^t,g_2)$ and $e(g_1,h)$. If the two pairings are equal then $h=g_2^t$.